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By sending systems in specially prepared quantum states, two parties can com- 

> ' 

^ . municate without an eavesdropper being able to listen. The technique, called 

O^. quantum cryptography, enables one to verify that the state of the quantum sys- 

j . tem has not been tampered with, and thus one can obtain privacy regardless 

X. 

^ . of the power of the eavesdropper. All previous protocols relied on the ability 

to faithfully send quantum states. In fact, until recently, they could all be re- 
duced to a single protocol where security is ensured though sharing maximally 
entangled states. Here we show this need not be the case - one can obtain ver- 
ifiable privacy even through some channels which cannot be used to reliably 
send quantum states. 

The nature of quantum systems and our ability to manipulate the state they are in has had 
a radical impact on the field of information theory and computation. A quantum computer can 
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solve problems which a classical computer cannot, and photons prepared in special states can 
be used to obtain privacy between two individuals sharing a fiber-optic channel - a situation 
impossible classically. Researchers in quantum information theory are trying to understand 
what aspects of quantum states and manipulations are responsible for the power of quantum 
computation and cryptography. 

In the case of cryptography the ability to faithfully send arbitrary quantum states (T) ap- 
peared to lay at the heart of obtaining privacy. In the original protocol, BB84 (2), two-level 
quantum systems such as photons were faithfully sent in eigenstates of one of two complemen- 
tary basis, which allows both privacy and the faithful sending of quantum states. Equivalently, 
entanglement based schemes © relied on the faithful distribution of maximally entangled pure 
states, which again allows the transmission of arbitrary states. In reality, the quantum states 
used in such protocols are so fragile that interaction with the environment (or the eavesdropper) 
causes them to rapidly decohere. However, if there is not too much noise, one can perform 
quantum error correction on the states, as one does in quantum computation, or post-processing 
on the raw key, to overcome the noise. The environment and the eavesdropper then become 
decoupled from the quantum states and the two parties can then obtain privacy. 

Since all known protocols achieve privacy by decoupling the eavesdropper from the sent 
states, there was much reason to assume that this is necessary. This implied that the faithful 
sending of arbitrary quantum states (such as halves of maximally entangled states) appeared to 
be a necessary precondition for privacy. In other words, all previous cryptographic schemes are 
qualitatively equivalent to each other, and equivalent to distilling pure state entanglement. The 
first step in showing that this need not be the case was in Q in the scenario where trusted states 
are given to the parties. There, we obtained the most general state which can produce a private 
key upon measurement. One can then recast all of quantum cryptography as a protocol which 
distills these private states under local operations and classical communication (LOCC). It was 
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then shown that there exist private states which are not equivalent to pure state entanglement. 
In fact, they can be produced from channels which have zero capacity (l5l|31) - the channels 
cannot be used to faithfully send arbitrary quantum states, but they can produce states which 
are private. However, a key ingredient remained. For quantum key distribution (QKD) it is not 
enough for two parties to share a private state, they must be able to verify this privacy. One 
imagines a scenario where the eavesdropper actually gives the two parties the states, or the 
parties produce the states through a channel which the eavesdropper can tamper with. One must 
be able to verify that one indeed holds a private state and not something else. 

Here, we provide a protocol which allows two parties (Alice and Bob) to verify that they 
indeed possess private states using only LOCC. This works for all private states, even those 
which can be created from zero-capacity channels, thus allowing us to obtain security over 
channels which cannot be used to send quantum information. The protocol is thus inequiva- 
lent to the original schemes. We previously dZ]) had introduced a protocol which worked over 
channels which could have arbitrary small capacity, but the protocol cannot be extended to the 
case where the capacity is strictly zero. Here, we will simply sketch the proof of security of our 
protocol. The technical details are contained in the appendix as well as in ® . 

Let us recall that there are two scenarios for QKD. In entanglement based schemes, an 
adversary gives states to Alice and Bob and they distill pure entanglement in the form of the 
maximally entangled state 1$^;) := ^ ^^Li where {\i)} is a computational basis for 

the local systems A and B possessed by Alice and Bob respectively. They then verify that 
they indeed possess states very close to this form, and then measure in the computation basis 
to produce a secure key. One also has prepare and measure protocols, where Alice prepares 
a quantum state, sends it to Bob who then measures it in some basis. They then examine the 
results to verify that the sent states were not overly tampered with, and then perform classical 
post-processing on the results to obtain a key. The two schemes are equivalent in the sense that 
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Figure 1 : For a channel with non-zero capacity (left hand side), maximally entangled states can 
be distributed such that measuring in any direction will produce a private key. The eavesdrop- 
per is completely decoupled from the state. For the channel on the right hand side with zero 
capacity, the distributed states only produce a private key if the measurement is made along the 
blue axis. It can be shown that the eavesdropper must know at least one bit of information, but 
due to the ancilla on A'B' (the "shield"), the bit of information is not about the key. 

current prepare and measure schemes can be reduced to protocols which rely on the distilla- 
tion and verification of maximally entangled states as shown in (9). In (4) it was shown that 
one could consider more general schemes where one considered protocols which rely on the 
distillation of states of the form 

7^ = U{\<^dAB){'^dAB\® PA'B')U^ (1) 

U = \ij){ij\AB ^ UjjA'B' (2) 

ij 

and viewing any protocol as the distillation and verification of such private states. Here pa'B' is 
an arbitrary ancilla, the UijA' b' are arbitrary unitaries on it, and U is called twisting. 

We now give the protocol for verifying private states, and prove its security. The protocol is 
a twisted version of verification schemes of and in the spirit of @ we will prove security 
of our protocol by reducing it to security of the protocol due to Lo and Chau (|7Q1) . Let us recall 
that the Lo-Chau protocol is as follows: 

(1) Alice can locally prepare n systems in the state |$2) and distribute Bob's share to him 
through an untrusted channel where the eavesdropper can attack all of Bob's share at once 
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before it gets to him. After this step, they share the state po- 

(2) Perform tests (via public but authenticated discussion) on po by randomly selecting rrix 
and rriz systems, and measuring ® to estimate the bit error rate e^, and ® to measure 
the phase error rate e^. Here, the a are the standard Pauli matrices. The error rates essentially 
tell us how far po deviates from a maximally entangled state. 

(3) Based on the results of the test, the parties perform an appropriate entanglement purifi- 
cation protocol (EPP) to Po and output a state 7 which will be close to the maximally entangled 
state with high probability. One doesn't need to know the exact form of po, but only the error 
rates. 

(4) Generate a key by measuring 7 locally. The key can have varying size (depends on the 
error rate), and zero key-length means "abort QKD." 

The security of this protocol rests on the fact that the estimates e^, of the two error rates 
by random sampling will converge with high probability to their expectation values over the 
entire initial state po thus ensuring that the final state 7 is close to maximally entangled. For 
small 5 and < we have for example (|70|) 

Pr(|e,p-e,| > (5) < 26-2"^^^' (3) 

where e^p is the expectation value of the phase error rate. This result is from sampling theory 
and can be found as Proposition 1 in the appendix. 

We now wish to modify this protocol so that we can use it to verify private states, which 
for the moment we take to be many copies of 7^. In (|?1 [771[72)) examples of such states were 
given which result from zero-capacity channels (i.e. they are bound entangled (|73l)). and thus 
our protocol will work over such channels. 

Since private states are twisted maximally entangled states, we could achieve verifiable 
privacy, by untwisting the private state before each step of the protocol, so that we are just 
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acting the above protocol on the maximally entangled state. We would thus need to modify the 
protocol as follows: 

(2') Apply untwisting f/®"t to po, then estimate and on the (Ai?)®" systems as in the 
original step (2), and finally reapply f/®". 

(3') Apply untwisting f/®"t^ measure out a "raw-key" in the computational basis of the 
remaining n— m^,— systems. 

(4') Perform error correction and privacy amplification on the raw-key via public discussion. 

Such a protocol is unfeasible since U may be a global unitary and cannot be done using 
only LOCC. However, it is secure, since if we were able to perform the twisting and untwisting, 
the only difference between this protocol and that of the Lo-Chau one is that classical privacy 
amplification (|7?1) and error correction is used instead of the entanglement purification protocol 
(EPP). This does not effect security, since it was shown U5\\16\i that there exist classes of EPPs 
such that applying the EPP and measuring out a key can be securely converted to protocols 
where a key is first measured out and then we apply classical error correction and privacy 
amplification on the raw key to obtain a secure one. We now explain how to convert the above 
unfeasible protocol to a feasible one which can be performed via LOCC. 

First, in step (2'), for the n—m^—niz which are not used for testing, the twisting and un- 
twisting cancel and therefore, do not need to be performed. Also, the measurement of bit errors 
via eg) Oz on AB commutes with the twisting and untwisting, and therefore, the twisting 
and untwisting cancel. Similarly, in step (3'), the measurement commutes with the untwisting, 
and therefore this untwisting is also unnecessary. Finally, for step (2'), untwisting the state, 
estimating the expected number of phase errors, and retwisting is equivalent to estimating the 
twisted phase error rate via the operator S^. = Uaba'B'{(^x ® cTx ® Ia'B')U\^ba'B'- Mercifully, 
our only remaining task is to find a way to estimate this error rate via LOCC, rather than via 
direct measuring of the global operator T^. 
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To do this, we will first decompose S^. in terms of products of observables which can be 
locally measured by Alice and Bob. We then show that this estimation of the observable in 
terms of these product observables is a good estimation. As will be explained shortly, this 
involves adapting the quantum deFinetti theorem (|77l) and a Chemoff-like bound. 

We can always decompose any observable into product observables. In particular: 

= UABA'B'icTx'^ (^x'» I)U\bA'B' (4) 
t 

= Yl ^JaJtOjaAA'^Oj^BB' (5) 

ja,j6 = l 

where {OjYj^i is a basis (trace-orthonormal) for hermitian operators acting on AA' and BB', 
and t = (Pd! . Alice and Bob can now estimate the average value of by dividing the 
samples into groups, and then estimating individually Oj^AA' and Oj^bb' on the zth test 
system. They then multiply their results publicly, and finally sum these products over i = 
1, ■ ■ ■ , niz/t^ with the coefficients given by Eq. ([5]). 

The outcome of this LOCC estimation procedure will result in giving some emperical value 
for the average of E^;, which we call (S*"'^)emp- We want to compare (S*"'^)emp to the emperical 
value (S)errtp obtained from estimating via a direct global measurement (which is the mea- 
surement that is performed in the unfeasible yet secure modified Lo-Chau protocol). If the two 
values are close, then we have shown that the LOCC measurement is a good estimation of S^; 

Indeed (S*"'^)emp will be close to (S)emp if the entire sample systems are in a joint 
tensor-power state Pq and if the number of systems we test is large enough. This follows 
from Eq. ([5]) and the fact that for tensor power states, we may regard each measurement as an 
independent event. We can then use the Chernoff bound which states that a random sample of 
k independent measurements of an operator O on state p®"^ will converge exponentially fast in 
k to its average value O = Tr(Op). More precisely, the probability that |0 — 0| > 5 decays 
as ~ e^cks'^ ^Qj. (J ^ positive constant. In this case we know that the estimate of each of the t"^ 
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local measurements will converge exponentially fast to Tr(poOj) as we increase the number of 
tested systems k = niz/t^. 

However, in our current problem, Alice and Bob share po which is not a tensor-power state, 
and each measurement cannot be considered to be an independent event. Fortunately, there is a 
sense in which a random sampling of systems is close to tensor-power. First, permutation 
symmetry can be imposed on the protocol (since we can choose a random sample in any order), 
and second, since the estimation involves only a small portion (m^) of the entire n systems, the 
exponential quantum deFinetti theorem (1771) states that the measured (reduced) state is close to 
a mixture of "almost-tensor-power-states". This is captured by Theorem 2 of the appendix. We 
can now apply a Chernoff-like bound to these almost-tensor-power-states. The exact analysis 
involves many adaptations of the results in (|77b and is given in the appendix as Theorem 1 . The 
result has consequences well beyond the current considerations. Essentially, any realizations of 
an observable (i.e. a decomposition of the operator in terms of others), is a good one, in the 
sense that performing one kind of measurement on m out of n systems via one realization of 
the measurement, will yield average values which are well correlated with the values obtained 
by performing another realization of the measurement on the remaining n — m systems. This 
is captured in Theorem 3 of the appendix. We can apply this to the current case to show that 
the probability that |(S*"'^)emp — (S)emp| > ^ can be made small. This says that the estimated 
twisted phase errors through measuring a sample via LOCC is correlated with the result we 
would obtain if we made an ideal measurement of twisted phase errors on the rest of system. 
Thus in terms of security, the only difference between the modified protocol, and that of Lo- 
Chau, is that instead of Equation [3] governing the accuracy of the phase error estimate, we have 
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through Theorem 3 



Pr |(S' 




>ind\(m) jsp\(m+n) 



< 



2e 



+ 



{t" + 1)2 



+ 



(6) 



where the three expressions in the upper bound respectively come from the exponential quantum 
deFinetti theorem, the Chemoff bound, and random sampling theory. Here, d is the dimension 
of the maximally entangled state and we can take d = 2, d' the dimension of each ancilla on 
A'B', and r is some natural number we will take to be > d'^d''^ Inn. The superscripts for the 
emperical values of T.^ refer to (S*"'^)emp being measured using m systems while {T)ernp is 
measured on the remaining n — m. 

This then proves security of the entire scheme, since the only significant change from the 
unfeasible modified protocol is a different method for estimating phase errors. The calculation 
of security in terms of composable security parameters for QKD (17^ is given in @. 

We now touch on several issues which arise. The protocol we have given, as with all entan- 
glement based protocols, relies on keeping the quantum state po from decohering throughout the 
procedure, and it is therefor not currently practical. However, it can be converted to a prepare- 
and-measure protocol where Alice prepares a state, sends it down a channel (which might have 
zero quantum capacity), and then Bob measures the state right away. The conversion adapts 
well known techniques and is contained in @ along with an example. 

Next, in the above protocol, we considered verification of tensor powers of private states 
with dimension two on A i.e. 7f " under general attacks. It is straightforward to extend this 
to the verification of private states of any dimension, and states where the twisting is close to 
tensor power. It is not clear whether one can extend this to private states which are not tensor 
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power such as a single 7^; as of yet we do not have a no-go theorem. This is quite different from 
verification of pure state entanglement where the maximally entangled state of any dimension 
can be written as |$2)®" and we are thus always trying to verify something close to tensor 
power. 

Here, we considered a twisted version of the Lo-Chau scheme, but we could have just as 
well considered twisted versions of other parameter estimation schemes. Indeed our protocol 
is not optimal in its use of resources and it may be interesting to improve it. Some potential 
avenues were noted in @. A tomographic verification scheme was suggested originally in 
and it may be interesting to explore its efficiency. It is simpler in the sense that one could just 
discard some states, and be left with almost-tensor-product states as in (|77|) . 

Finally, here we have demonstrated conceptually that quantum key distribution is not equiv- 
alent to the ability to send quantum information. However, we only know of a few channels and 
set of states which have the property of offering security without allowing quantum communi- 
cation. It would be very interesting to find other examples, and perhaps even more interesting 
to know whether there are any bound entangled states (and the corresponding zero-capacity 
channels) which cannot produce a secure key. 
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Appendix 

In Section [T] we present Theorem 1 on the extent to which a permutationally invariant set of 
systems behaves like independently and identically distributed (IID) states for the purpose of 
parameter estimation. This is an application of the quantum de Finetti theorem and the gener- 
alized Chernoff bound. Section [L2] presents some results which will be used in Section [L3l It 
is in this latter section where the key Theorem 3 is presented in Subsection [031 It relates the 
distance between direct measurements and indirect measurements of an observable. 

1 LOCC estimation of the expectation of an IID observable 
1.1 Finite quantum de Finetti theorem and generalized Chernoff bound 

We say that a state p„ on Hilbert space 7i®" satisfies the Chernoff bound with respect to a state o 
on Ti and a measurement M.onl-iii (with high probability) frequency distribution obtained 
by measuring TW®" on p„ is close to that of measuring M. on a. For example, p„ = cr*^". 
However many other states satisfy the same property. An important class is called almost power 
states, which are formulated and studied in (17). We adapt results in (|77l) for our own purpose 
in the following. 

Theorem 1 (Finite quantum de Finetti theorem plus Chernoff bound) Consider any permu- 
tationally invariant (possibly mixed) state pn+k on Hilbert space 7Y'^("+'''). Let pn = Tr^Pn+k be 
the partial trace ofpn+k over k systems. Then there exists a probability measure /x on (possibly 
mixed) states a acting on H and a family of states pn} such that 

1. The state pn is close to a mixture of the states pn)- 

<2e-^+^''''"('^)''"'= (7) 

tr 



Pnl df^i^) 
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2. The states pn}r (called almost power states) satisfy the Chernojf bound in the following 



sense 



VT{\\PM{(y)-QM{p^:l)\\>5) 

<2-"[#-'^(S)]+l^|i°g(t+i)=:e(5) (8) 

where M.={Mw}w^w is any measurement on H, Pm{(^) = {Tr(crMt„)}^, QM{Pn}r) is 
the frequency distribution obtained from measuring A^®" on the state pn)-, and \ W\ is 
the size of the alphabet W. 

3. Reduced density matrices of the states pn}r (to n' < n systems) satisfy the same Chernoff 
bound: 

Pr(||p^(a)-g^(pi;)„,)|| >5) 
< 2-"'[4-M;?r)]+|vy|iog{f+i) 

where r < n' /2 and p^ln' — Tr„_„' Pn^r is the partial trace of pnj- over n — n' systems. 



Proof: We first collect various facts, definitions, and results from (|i7l) . 
1.1.1 Facts and definitions 

Definition 1 Almost power state: (Def. 4.1.4, in (173) Suppose < r < n. Let Sym(7Y®") 
denote the symmetric subspace of pure states ofHilbert space Ti®'^. Let \6) ^Hbe an arbitrary 
pure state and consider: 

where Sn is the permutation group of the n systems. We define the almost power states along 
\0) to be the set of pure states in 

|^^[®,n,r] _ Sym(7i:®") n span(V(7^®", l^)®""")) (10) 
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We denote the set of mixtures of almost tensor power states along \9) as conv(|^)t®'"''"'). 
With the above definition, we shall prove the following lemma: 

Lemma 1 IfQn e conv(|^)[®'"''^l), then, Q^-m e conv(|^)[®'"-'"''^]) where g^-m = Tr^(^„) is 
the reduced density matrix after the partial trace over any m out of the n systems (by symmetry, 
without loss of generality, we take the first m systems). 
Proof .- 

Since membership in conv(|6')l®'"^'"''"l) is preserved under mixing, it suffices to prove the 
lemma for pure ^„ = |^)(^|, with |^) G 

We can pick an ensemble realizing f)„-m of our choice, and prove the lemma by showing 
that any element |\t'„_m) in that ensemble belongs to |6l)[®'"~™'^]. Our ensemble is obtained by 
an explicit partial trace of |\&„) over the first m subsystems along the computational basis. An 
element is given by 

l^n-m) = {il\---{im\ ® /„_m|^n)- (H) 

Now, we note two facts: 

(i) e Sym(7^®("^™)) - This is because G Sym(7^®(")) = span(|0)®"). 

(ii) |*„_„) G V(7^®"-™, _ This is because G V(7^®", \9)'^''-^), and 
expressing in terms of the spanning vectors of V(7i®", |6')®"~'') and putting it into Eq. (fTTI) . 
we have 

= J2 «*r,7r(^l| ■ ■ ■ {im\ ® In-m VT (1^)®""'' (g) |*,)). 
*T-,7r 

Elementary analysis shows that any term of the above sum is, up to permutation, of the form 

{{ii\9))--- {{ip\e))\e)'^^--~P0[{ip+i\ ■ ■ ■ {im\0lr-{n.-p) 7r'(|^.))] whcrc < p < m, and "ab- 
sorbing" m—p copies of 6'to the last part of the vector, we get \6)'^'^~^'^~^"^^ ^l"^''.) . Thus, |\E'm-n) 
is a sum of terms of the form 7r(|^)®"-(^+"^) ® |^';)), and belongs to V(7^® |^)®"-(^+'^)). 
This proves the second fact, and also the lemma. □ 
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Property of a mixture of almost tensor power states behaves approximately like a mixture 
of tensor power states, so that the generalized version of Chernoff bound holds. 

Lemma 2 (Theorem 4.5.2 of (77)) Let M = {M^}.^ew be a POVM on H, let < r < f . 

Moreover let \6) e H and let jvp^) be a vector from There holds: 

P{\\PMm{d\)-PM[\^n){^n\]\\>S) 

<2-"[x-M^)]+|w-|iog(f+i) _ ^^^^ 

where PM{\0){d\) = {Tr|^^) (6'| M^,}^ and Pa4 is the frequency distribution of out- 

comes of A4^^ applied to |\E'„) (\[^„|, and the probability is taken over those outcomes. Note 
that we have used e{6) instead of6{e) in f lTTI) . 

Consider the general probability Pr ( || Pa4 (p) — Pm [Qn] || < where Pm [Qh] is a frequency 
distribution of outcomes of applied to The distribution PmIQu], if treated as a 

functional of Qn on the space is linear in Qn- Following this we get immediately: 

Corollary 1 Lemma\2\holds when replacing the projector (for \'^n) G by 

Qn e COnv(|e)[®'"''-]). 

Apart form the generalised Chernoff-type lemmas, we also need the crucial exponential 
quantum finite deFinetti theorem: 

Theorem 2 (Theorem 4.3.2 of (77)) For any pure state \iJn+k) e Sym(7^®"+'=) andO <r <n 
there exists a measure dudO)) on H and for each \6) G H a pure state \tpn^) G |6')[®'"'''"] such 
that 



H 



tr 
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Finally, we need the fact that any permutationally invariant state has a symmetric purification. 

Lemma 3 (Lemma 4.2.2 of diTl) ) Let pn be permutationally invariant state on Ti. Then there 
exists purification of the state on Sym((7i ® Ti)*^") 

This concludes the list of facts and definitions needed for proving Theorem [TJ 
1.1.2 Proof of Theorem [1] 

Consider an arbitrary permutationally invariant state Qn+k on Hilbert space 7Y®("+^). 

Step (1): According to Lemma [3] there is a purification \il)n+k) that belongs to Sym(7i'®""'"'^) 

where H' = H®nsind dim{n) =dim{n). 

Step (2): We apply to i/jn+k theorem [21 with the changes 

n n' = n0n 

d ^ £ (13) 

Step (3): After application of theorem[2lwe perform partial trace over 'H®'^, the purifying spaces 
introduced in (1). We denote this partial trace by Tr. This partial trace induces from the measure 
on Ti' in step (2) the new measure n^a) on the set of all mixed states a defined on Ti. (This is 
defined by probability ascribed by the measure /x to the subset of H' equal to the equivalence 
class of all pure states \6) which satisfy Tr(|^^)(6'|) = a). This partial trace produces also the 
states Pn} defined directly by pn} = Tr(|?/'^f'')(?/'i^''|) where the existence of the pure states 
\ipn'^) is guaranteed by theorem |2l Finally we note that partial trace does not increase the trace 
distance between two quantum states, so applying partial trace to the LHS of (fT2l) and using the 
notation described above we get immediately the inequality ([7]). This proves the first item of 
Theorem ([T]). 

To prove the second item of Theorem ©, remember from the above that pn} = Tr ( | ipn'^ ) {ipn^* \ ) . 
Since \^^n^) is an almost power pure state, lemma[2] applies. Further, it holds for all POVM-s on 
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H' = Ti. ^H, and in particular for incomplete POVM-s acting only on H but not on H. Thus, 
the conclusion of lemma [21 holds with the change: — ® /, which gives item (2). 

Finally, to prove item 3 of theoremfH note that the reduced density matrices g"^ ^ of interest 
can be obtained from the pure state above by tracing (i) first over n — n' subsystems 

corresponding to Ti' , producing a state on Ti'®^' , and (ii) then over n' subsystems corresponding 
toTi:. 

Then lemma[i|guarantees that the first partial trace produces a mixed state Qn' in conv( 1 9) ) 
(with underlying space Ti' . Applying corollary [U to Qn' with n' instead of n, it suffices to 
consider a pure state in |6')[®'"''"'~^']. Finally, lemma [2] can be applied to this pure state with 
Ai M. ® I which concludes item 3 (with the assumption < r < y). □ 

1.2 Two other useful results 
1.2.1 Classical random sampling 

In addition to the fact and definitions above and Theorem [H we will need the following result 
on classical random sampling (or equivalently symmetric probability distribution). 

Proposition 1 (Classical sampling theory) Lemma A.4 from (TP'). Let Z be an n-tuple and 
Z' a k-tuple of random variables over set Z, with symmetric joint probability P. Let Qz' be a 
frequency distribution of a fixed sequence z' and Q(z,z') be frequency distribution of a sequence 
{z, z'). Then for every e > Owe have 

Pi\\Qiz,z')-Qz'\\>e)<\Z\e-''^"/^\^\. (14) 

The result says that frequency obtained from a small sample is close to frequency distribution 
obtained from the whole system. 
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1.2.2 From probabilities to averages 



Lemma 4 Consider an observable L on Hilbert space H, dim Ti — d. Let L — Yll=i ^i^i' 
where satisfy TrLjL^ = 5ij. Let eigenvalues of Li be denoted by X[^\ Consider arbitrary 
state p, and let P^*) = {p[^^} be the probability distribution on I (which eigenvalue) induced by 
measuring L^ on p. Let Q^*^ = ^} arbitrary family of distributions on eigenvalues of 
Li. We then have 



i I 

< Vi||L||j/5niax||P« -g«||, 



where || • ^hs is the Hilbert-Schmidt norm, 

norm. 

Proof 



i I 

i I 

(max|Af^|)||P»-g(^)| 

i 

— ^ ^ II l|oo ||-^^^ g^^jj 
i 

< (max||p(^)-g(^')||) ||L,||, 



< 



Since | |-^i| |oo — 1> using convexity of x"^ we obtain 



i=l i V * 



HS 



(15) 



is the operator norm, and \\ ■ \\ is the trace 



(16) 



(17) 



which ends the proof. □ 
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1.3 Estimation - detailed description 

We consider 2m + n systems with Hilbert space 7^«'(2m+")^ dimTi — d in a permutationally 
invariant state g2m+n- Suppose the ultimate goal is to obtain the "frequency mean-value" of 
some single-system observable S on n -|- m systems. In other words, we want to measure 
F Y^J=i ^^^^ where E^-?) = 7 (g) 7 • • • O E O • • • 7 on the subsystems for N ^n + m. 

Because of experimental limitations (here, it is the LOCC constraints on Alice and Bob), 
they are restricted to measuring product operators of the form L = La® Lb hy independently 
finding the eigenvalues of La and Lb (i.e., making the measurements La® I and I ® Lb), 
discussing over classical channels and multiplying their outcomes together. Now, to measure 

E, one can first rewrite it in terms of product operators Lf. 

t 

E = J2s^Li (18) 

i=l 

where we have chosen {Lj} to be hermitian and trace orthonormal, so that Sj are real. The L^-s 
are "intermediate obseryables." We will describe an inference scheme that (1) involves only the 
estimation of the "frequency mean-value" of E on a small number (m) of subsystems, and (2) 
the measurement of E is done indirectly via measurements of the L/s. 

The analysis will start with special assumption about the 2m-element sample, m of which 
are used for indirect estimation. The assumptions are relaxed on that sample. After that proper- 
ties of the other m + n subsystems are inferred. 

1.3.1 Analysis of the 2m sample in an "almost power state along cr":^2m,r 

Suppose the first 2m subsystems are in a joint state ^'2m,r' ^^^h r < | x 2m. We expect the state 
g^2m,r Pl^y ^ similar to the state cr®^"^. Define the theoretical direct average 

(E), = Tr(Ea) = ^s,(L,), (19) 

i 
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We will show that the empirical average, either obtained directly or indirectly, will be close to 
the above. 

For the indirect measurement, divide the first m subsystems into t groups. Each group 
has m' = m/t subsystems. Alice and Bob take the ith group (i = 1, ■ ■ ■ , t) and measure Lj 
on each site as described above (the measurement is Ci). In other words, the measurement 
j^^indirect _ ^j^^(^jC,f'^' ) is applied to the first m subsystems of the entire 2m + n subsystems. 
The reduction of the state fPgm r to the first m subsystems induces probability distribution V on 
the outcomes of M'""^^''''\ 

Since we expect r ^^'^ to behave similarly, consider the probability distribution on 

u\ 

alphabet Ai of observable Li = J2i K^i induced by the state a as follows: 

Pi = {TT{aPi)}i (20) 

An execution of the measurement Cf"^ gives a particular outcome {li, ...Jm') and induces 
frequency distribution Qi on alphabet Ai of the observable Li. 

Then, the empirical frequency distributions Qi is close to the "theoretical" distribution Pj: 

Factl 

Vm-Q.\\>6)<e{6,m',r,d), (21) 
where d is the dimension of the single site Hilbert space, and 

e(5,n,r, \Z\) := 2-(#-^(S))"+l^|i°g(f +i) (22) 

Proof - Follows immediately from the third item of Theorem [IJ Note that we use item (3) 
not (2) since we perform the measurement only on part of the state ^2m,r- 
Remark - Note also that Pi is constant while Qi is a random variable. 
Now, we define the theoretical average values for the intermediate observables L/s: 

(L,), = Tr(Lia) (23) 
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and the empirical average 

{U),^p = Y,>H~^Q^{l) (24) 

where Qi{l) denotes value of Qi on specific event / from alphabet Ai. (Again, (-Lj)^- is constant 
while {Li)emp is a random variable depending on the particular outcomes of measurement - 
recall that Li = ^ . Af ^P/'^ ). And again, recall that we the empirical value of S obtained 
indirectly, via empirical distributions of the Lj. 

(^*"'^)imp — Si{Li)emp ■ (25) 

i 

We now show that the indirect empirical average is close to the direct theoretical average in 
Eq. (fT9l) . First applying the union bound to FactfH we get 

V{Ui=i_t{\\Pi-Qi\\>5})<t-e{5,m\r,d) (26) 

Then using LemmaHwe obtain that P(| X]iSi(Lj)<^-X;-Si(Li)emp| > 5) < t-e( m', r, d) 

which is just 

P(| (S). - (S-'^)iil >5)<t. e( ^ m', r, d). (27) 

After considering the indirect measurements, suppose that someone measures directly M^^^^'^^ = 
Ylj=m+i ^'^"'^ '^^ '•^^ second group of m subsystems. The empirical average outcome is given 
by 

(S)(i = 5^7.Q(a:) (28) 

X 

where Q is the frequency distribution on the alphabet of S (similarly as Qi is the frequency 
distribution of alphabet Ai of Ci), and 7^. are some real numbers. In a way similar to the indirect 
case (but much easier here) we show that the empirical direct average is close to Eq. (fT9l) : 



P(KS). - >6)< e(— ^,m,r,rf). (29) 



From the inequalities (|27l) . (|29l) we obtain 
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Lemma 5 For the measurements on the state f?2m,r considered above we have: 

m(s)S-(s^"')Si>25) 

< t ■ e[ ^, m , r, a) + e(— — — ,m,r,d) 



l^WnsVi' ' ' ll^l 



HS 



< {t + l)ei-— ^,m',r,d) (30) 

WmHsyt 



Proof. - Here triangle inequality and union bound to inequalities (|27l) . (1291) suffices together 
with the properties of e(5, n, r, ci). 

1.3.2 Passing from ^2m,r"S to their integrals and then to a close-by state 

Note that both integration and the measurement of a state to produce the classical distribution 
of the outcomes are both linear, completely positive, and trace-preserving maps. Thus, Lemma 
Ostill holds under the replacement f)2m,r ^ / ^?2m,r'^/^('^)- Furthermore, if 

\\Q2m- j Q2l,rd^^{(^)\ \ < ^ (31) 

and since the trace distance is nonincreasing under the measurement (a TCP map), the output 
distribution is different by no more than e. In this way we have proven 

Lemma 6 For a state Q2m of 2m systems satisfying \ \Q2m — J Q2m,rdf^{<^) \ \ < twe have 

r(|(S)(™),-(S-'^)(il>25) 
< {t + l)e{-— ^,m',r,c/) + e. (32) 

where V is the probability distribution on outcomes of measurement Cf'"^ . . . ® Cf"^ 7V1 ®™ 
induced by the state Q2m- 

1.3.3 Inferring direct average on n + m samples of general state Q2m+n from indirect 
measurements on m samples 

Now we pass to the general permutationally invariant state Q2m+n- We want to relate the distance 
between (S^"'^)^, the indirect estimation of S obtained via LOCC measurements [Ci] on 
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m of the systems, and the direct estimation (S)imp"'' of S, we would obtain via the direct 
measurement Ai on the other n + m systems. We have the following: 

Theorem 3 Consider permutationally invariant state Q2m+n on 7-^®^™+" and dim Ti = d. On 
this state we perform the measurement Cf™" ® ■ ■ ■ ® Cf"^ which induces the prob- 

ability measure V". (Note that V from Lemma^is simply the marginal ofV".) Then we have 

- (E)S-))| > 3S) < ei + e2 + e3 (33) 



where 



n(r+l) . 1 ,2 1 

ei = 2e"5P^^+2'^ (34) 



62 = (t + l)2 ^'ii^ii^s ' (35) 



and 



63 = de (36) 



where \ \ ■ \ \hs the Hilbert-Schmidt norm. 

Proof - The parameters 61,62, 63 come from the generalised quantum de Finetti theorem, 
Chernoff bound and sampling proposition respectively. 

To start with the proof note that from Theorem [TJ item 1 we get that for g2m = ^^n62m+n 
we have \ \g2m — J f?2m,r'^/^(^) 11^^ with e = 61. Applying then Lemma[6]we get that 

V'im^Zl - > 26) < 61 + 62 (37) 

Now we need to connect with For this we need sampling Proposition 

mV'iWQ'S - Qe^"I I > < de-"'^'/^'^ where is the frequency distribution on outputs of 
M induced by the state pm (partial trace of P2m+n over m + n systems and Q™^" is frequency 
distribution induced on outcomes of M by state Pm+n (partial trace of P2m+n over m systems) 
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and d is the dimension of elementary Hilbert space H (thus Q2m is defined on 7-^® 2m Using 
Lemma in we go to the averages 

r'(|(S)(-),-(S)(-+")|>35)<e3. (38) 
Applying the union bound to Eqs. (|37|) and (l38l) we get finally the statement of the theorem. 
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